Security precautions

[afshin]

trafficstars

Introduction

On the cusp of our 1.0 release, we should revisit our security procedures to make sure we are taking reasonable precautions to protect our users and ourselves.

I propose the following checklist as a model for how we handle these issues.

Risk factors

We recognize that our project is high profile and it could be a vector of attack in a few ways:

	Vector	Severity	Risk
1	Malicious code injection into JupyterLab source	high	low
2	Compromised dependencies in package.json files	high	moderate
3	Publishing compromised Python packages to PyPI/Conda	high	low
4	Publishing compromised JS packages to NPM	high	moderate

Mitigation - how we handle these risks

1. Malicious code injection into JupyterLab source

• [ ] Know your maintainers (KYM): careful trust-building in each maintainer who has merge rights
• [ ] A sound code review process for every pull request; all PRs must be reviewed by someone who is not the author and must pass the automated test suite
• [ ] Mandatory two-factor authentication (2FA) on GitHub for maintainers who can merge pull requests

2. Compromised dependencies in package.json files

• [ ] Regularly reviewing outdated dependencies before each release
• [ ] GitHub's NPM dependency notifications

3. Publishing compromised Python packages to PyPI/Conda

• [ ] Mandatory two-factor authentication (2FA) for PyPI
• [ ] Mandatory two-factor authentication (2FA) on GitHub for users who merge conda-forge pull requests

4. Publishing compromised JS packages to NPM

• [ ] Mandatory two-factor authentication (2FA) for NPM

[blink1073]

We don't publish to conda directly. It is done via merging a pull request on the conda-forge repo.

[afshin]

Cheers, updated the list.

[jasongrout]

* Know your maintainers (KYM): careful trust-building in each maintainer who has publishing rights.

KYM for each maintainer who has merge rights as well as those that have publishing rights. Note that those two sets are distinct. For example, our conda-forge package has a maintainer with publish rights (i.e., merge rights on the conda-forge feedstock) who does not have merge rights in the jlab repo.

[vidartf]

Mandatory two-factor authentication (2FA) for PyPI.

Note that there isn't proper 2FA for PyPI. There is some work in progress that they call 2FA, but it is more of a 1.5FA

[blink1073]

AFAIK the only remaining issue is recovery codes: https://github.com/pypa/warehouse/issues/5800

[afshin]

I haven't tried publishing on PyPI since I added 2FA to my account.

[afshin]

@jasongrout You're totally right. I had that in three spots and when I consolidated, I did not clarify. Updated now.

[vidartf]

@blink1073 I mean that 2 factors are not needed on upload, only to generate a token that is stored for use on upload (https://github.com/pypa/warehouse/issues/5815). This means there is only one factor when uploading (something stored on your computer).